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AMENDMENTS TO THE CLAIMS 

Claims 1-14 (Canceled) 

Claim 15 (Currently Amended): A system for identifying service abuse, comprising: 

a plurality of server computers each adapted to receive an event and to create an event 
packet in response to the event; 

a cluster host adapted to receive a plurality of event packets from at least a portion of the 
plurality of server computers and to update a master screening table in response to the plurality of 
event packets, 

wherein the cluster host is further adapted to communicate a local screening table 
comprising at least a portion of the master screening table to each of the plurality of server 
computers, and each of the plurality of server computers is adapted to: 

receive the local screening table from the cluster host; 

receive an event requesting a service; 

create an event identification associated with the event; 

select a table entry from a plurality of table entries in the local screening table as a 
selected table entr y, wherein the selected table entry advances cyclically through the local screening 
table, and the selected table entry advances to a next entry of the local screening table in response to 
the event identification not being present in the local screening table ; 

increment a first count value associated with a first table entry of the plurality of table 
entries in the local screening table in response to the event identification matching an event 
identification associated with the first table entry; 

decrement a second count value associated with the selected table entry of the plurality 
of table entries in response to the event identification not being present in the local screening table 
failing to match an event identification associated with the selected table entry ; 



pa-1284557 



Application No.: 10/803,473 



3 



Docket No.: 324212008500 



replace the selected table entry with the event identification associated with the received 
event in response to the second count value equaling a predetermined value; and 

determine a metric value for the event from the local screening table, the metric value 
indicating that the event is an abusive request. 

Claim 16 (Original): The system of claim 15, wherein the local screening table is a copy of 
the master screening table. 

Claim 17 (Previously Presented): The system of claim 15, wherein each event packet 
includes an event identification associated with an event. 

Claim 18 (Original): The system of claim 17, wherein the event identification corresponds 
with the identity of a user. 

Claim 19 (Original): The system of claim 18, wherein the event identification includes an IP 
address. 

Claim 20 (Original): The system of claim 18, wherein the event identification includes a 
user identification. 

Claim 21 (Original): The system of claim 17, wherein the event identification corresponds 
with a content value included in the event. 

Claim 22 (Original): The system of claim 21 wherein the content value includes at least a 
portion of a message. 

Claim 23 (Original): The system of claim 21, wherein the content value includes at least a 
portion of a URL. 

Claim 24 (Original): The system of claim 21, wherein the content value is a hash of the 
content value included in the event. 

Claim 25 (Original): The system of claim 15, wherein the cluster host is further adapted to 
determine a metric value for an entry of the master screening table, the metric indicating that the 
entry of the master screening table corresponds to an abusive request. 
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Claim 26 (Original): The system of claim 25, wherein the cluster host is further adapted to 
set a block value associated with the entry in response to the metric value. 

Claim 27 (Original): The system of claim 25, wherein the cluster host is adapted to 
determine an average metric value from the metric value and a set of previous metric values and to 
set a block value associated with the entry in response to the average metric value. 

Claim 28 (Original): The system of claim 15, wherein the cluster host is adapted to 
determine a first sub-metric value from the entry, to determine a second sub-metric v£ilue from an 
entry of a second master screening table, and to determine the metric value from a weighted 
combination of the first and second sub-metric values. 

Claim 29 (Previously Presented): The system of claim 15, wherein the predetermined value 

is zero. 

Claims 30-45 (Canceled) 

Claim 46 (Previously Presented): The system of claim 15, wherein each of the plurality of 
server computers is further adapted to select a second table entry as a new selected table entry in 
response to receiving the event. 

Claim 47 (Previously Presented): The system of claim 15, wherein each of the plurality of 
server computers is further adapted to select a second table entry as a new selected table entry in 
response to the event identification failing to match an event identification associated with the 
selected-table entry. 

Claim 48 (Previously Presented): The system of claim 15, wherein each of the plurality of 
server computers is further adapted to disregard the event in response to the metric value crossing a 
threshold value. 

Claim 49 (Previously Presented): The system of claim 15, wherein each of the plurality of 
server computers is further adapted to terminate a connection used to receive the event in response 
to the metric value crossing a threshold value. 
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Claim 50 (Previously Presented): The system of claim 15, wherein each of the plurality of 
server computers is further adapted to return an error message in response to the event in response 
to the metric value crossing a threshold value. 

Claim 51 (New): The system of claim 15, wherein the selected entry advances to a next 
entry of the local screening table in response to the event identification matching the event 
identification associated with the first table entry. 
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